Blog

Notes on x402, agent payments, and screening transactions before they happen.

• August 6, 2026

  The npm worm could reach 18 MCP servers, not the 36 an IOC name match reports

  The third Shai-Hulud wave went through 440+ npm packages on 4 August. I had just measured every npm-packaged stdio server in the official MCP registry, so I checked how far it got. Matching compromised package names against dependency trees said 36. Checking whether a caret range could actually have carried the malicious version said 18 — and keyv, the name present in all 36, was reachable in none of them. Here is the difference between a name and an exposure, and why the trees that were safe were not safe on purpose.

• July 31, 2026

  The median MCP server installs 94 packages, and 88% pull an HTTP framework into a stdio process

  I built an MCP server and measured what installing it costs: 95 packages, including express and hono, for a process that only speaks over stdin and stdout. Then I measured all 6,139 npm-packaged stdio servers in the official registry. The median is 94 — and 95 for a server on the v1 SDK, which is exactly where mine landed. Almost none of that is chosen by the people who wrote these servers, and almost none of it is visible in what they declared. Here's the data, two bugs I found in my own measuring code, and what the new SDK v2 changes.

• July 26, 2026

  A changed payTo address is not a honeypot: 272 payTo changes, 13 lookalikes, zero proof

  I built a detector that flagged x402 endpoints for changing their payment address and pointed it at the public Bazaar for a month. It labeled Tavily and Browserbase high-risk. Every one of its 272 flags failed to support that label — including the 13 that had the exact shape of an address-poisoning attack. Here's the data, the five separate ways the detector was wrong, and what I changed.

• June 21, 2026

  Five ways an x402 payment can go wrong — and which ones you can catch before your agent pays

  A threat model for x402 agent payments: which attacks you can catch locally, before paying, in your own code — and which fundamentally need reputation data. With the actual check logic.